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Since  the  programs  inception  in  1999,  the  Navy  and 
Marine  Corps  Intranet  (NMCI)  has  soured  many  users  across 
the  Department  of  the  Navy  (DON) .  On  October  6,  2000  the 
NMCI  contract  was  awarded  to  Electronic  Data  System  (EDS) 
and,  five  years  later,  they  are  still  only  seventy  five 
percent  complete  with  fielding  systems.1  Users  that  have 
been  converted  have  complained  of  slow  service  and  problems 
incorporating  older  software.  Despite  user-frustration 
with  the  implementation  and  incompatibility  issues  of  the 
new  system,  NMCI  has  been  successful  in  improving  network 
security,  providing  greater  interoperability  and  providing 
valuable  lessons  learned  for  the  Marine  Corps. 

Background 

In  the  spring  of  1999  the  Navy  and  the  Marine  Corps 
briefed  the  Secretary  of  the  Navy  on  their  plans  to  improve 
their  Information  Technology  (IT)  infrastructure.  At  the 
time  this  brief  was  presented,  the  Marine  Corps  had  a 
contiguous,  self-contained  network  that  included  all  of  its 
bases  in  the  Continental  United  States  (CONUS) ,  Hawaii  and 
Okinawa.  These  bases  were  centrally  controlled  by  what  is 
now  known  as  the  Marine  Corps  Network  Operations  and 

'Frank  Tiboni,  "Navy  Marine  Corps  Intranet  75  percent  done,"  Federal 
Computer  Week,  18  November  2005,  <http://www.fcw.com/article91482-ll- 
18-05-Web>  (21  November  2005) . 


Security  Command  (MCNOSC  or  legacy  network) .  In  contrast, 
the  Navy' s  infrastructure  was  neither  centrally  managed  nor 
controlled.  Each  Naval  base  was  treated  as  a  local  asset, 
using  whatever  network  design,  hardware  and  software  the 
local  authority  approved.  When  the  Secretary  of  the  Navy 
decided  that  the  best  move  for  the  DON  was  to  create  one 
enterprise  network, 2  the  program  was  outsourced  to  EDS.  The 
decision  to  outsource  was  the  result  of  consulting  with  the 
top  IT  leaders  within  the  DON  and  with  a  research 
development  and  acquisitions  team.  These  teams  and  leaders 
determined  that  the  project  would  be  too  expensive  to  be 
done  internally  and  that  the  program  should  be  outsourced. 
The  contractor  from  whom  DON  would  buy  voice,  video  and 
data  services  would  also  provide  the  hardware,  software, 
and  connectivity.  EDS''  biggest  contribution  to  the  new 
enterprise  network  has  been  increased  security. 

Network  Security 

Network  Security  is  the  means  used  to  prevent 
unauthorized  access  to  the  local  or  wide  area  network. 

NMCI  has  taken  several  steps  to  improve  security.  They 
have  by  reduced  the  number  of  entry  points,  changed  the  way 

"NMCI  yesterday,  today  and  tomorrow, "  Navy  Marine  Corps  Intranet, 
<http://www.nmci.navy.mil/Press  Room/Media  Updates  Folder/Media  Update 
Items/Yesterday  Today>  (18  November  2005)  . 


updates  are  performed  and  developed  a  closer  working 
relationship  with  the  Defense  Information  Systems  Agency 
(DISA) .  In  a  November  18,  2005  article.  Federal  Computer 
Weekly  quoted  a  Navy  report  stating  that  NMCI  security 
improvements  have  stopped  ten  million  unauthorized  access 
attempts  and  quarantined  and  disinfected  sixty  thousand 
viruses  this  year.J  Prior  to  NMCI,  the  Marine  Corps  had 
numerous  entry  points,  known  as  Points  of  Presence  (POP, ) 
spread  across  the  network.  These  POPs  were  regulated  and 
monitored  by  the  MCNOSC  and  managed  by  the  individual 
owning  units.  DISA  provided  guidance  and  security 
requirements  to  MCNOSC  who,  in  turn,  enforced  these 
regulations  upon  the  individual  commands.  This  was  managed 
by  the  improvements  made  by  NMCI  regarding  security.  The 
first  step  to  improved  security  was  the  consolidation  of 
entry  points  to  what  are  now  four  hubs:  Norfolk,  VA; 
Quantico,  VA;  San  Diego,  CA;  Oahu,  HI.  By  reducing  the 
number  of  entry  points  NMCI  gained  greater  control  and 
visibility  over  the  traffic  that  comes  in  and  out  of  the 
network,  as  well  as  greater  ability  to  respond  to  and 
communicate  threat  activity.  Each  of  these  hub  sites  also 
has  a  DISA  representative  on  site  to  improve  communication 
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of  security  requirements  and  help  guide  actions  concerning 


the  network. 

Security  updates  are  performed  in  a  more  efficient 
manner  under  NMCI  as  well.  Under  the  legacy  system  the 
MCNOSC  would  contact  each  command  and  inform  them  of  the 
new  Information  Assurance  Vulnerability  Alerts  (IAVA)  sent 
out  by  DISA.  The  notice  would  include  a  required 
compliance  and  report  date.  However,  because  not  all 
commands  operated  a  help  desk  or  monitored  the  network 
around  the  clock,  there  were  times  when  the  IAVA  would  get 
lost  in  the  work  load  and  would  not  be  completed  until 
follow  up  contact  was  made  by  the  MCNOSC.  The  solution 
NMCI  provides  is  a  24-hour  help  desk  and  automatic  loading 
of  patches  when  computers  are  logged  on.  In  the  event  that 
a  patch  must  be  manually  loaded  an  NMCI  response  team, 
which  are  located  at  every  base,  can  be  sent  out  to  reply 
to  problems  or  apply  patches.  These  capabilities  ensure 
that  vulnerabilities  are  always  handled  in  a  timely  manner, 
limiting  the  time  a  threat  has  to  cause  damage  to  the 
network  or  to  exploit  a  known  weakness. 

The  most  significant  way  NMCI  has  improved  local 
security  is  in  its  ability  to  exercise  security 
restrictions.  Pre-NMCI  if  a  commander  desired  access  to 


software  or  assets  that  would  allow  for  a  vulnerability  to 


be  exploited,  he  could  direct  that  access  be  given  to  him 


to  receive  those  assets.  The  commander's  actions  would 
provide  an  exploitable  gap  in  the  defense  of  the  network. 
Even  though  this  only  occurred  under  extreme  circumstances 
using  the  legacy  network,  it  is  not  possible  at  all  under 
NMCI . 


Improved  Interoperability 

One  of  the  major  goals  the  Secretary  of  the  Navy  set 
when  establishing  NMCI  was  to  combine  the  DON  under  one 
interoperable  enterprise  network.  Interoperability  is 
defined  as  the  ability  to  communicate  between  two  different 
levels  or  services.  NMCI  has  made  strides  toward  this  end 
by  creating  the  enterprise  network  and  standardizing 
hardware  and  software.  The  enterprise  network  established 
by  NMCI  provides  standardization  and  interoperability 
between  the  Navy  and  Marine  Corps  and  sets  the  stage  for 
interoperability  between  other  services  as  well.  In  the 
five  years  it  has  been  in  development,  NMCI  has  converted 
260,000  of  the  346,000  required  computers  to  NMCI.4  Once  an 
NMCI  account  has  been  made,  a  Marine  can  travel  to  any 
location  converted  to  NMCI  and  log  onto  the  Marine  Corps 

4Tiboni,  "Navy  Marine  Corps  Intranet  75  percent  done," 
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Domain  Service  United  States  (MCDSUS) .  Once  logged  on,  the 
Marine  will  note  that  the  system  is  interoperable  and  that 
all  services  not  dependent  on  a  local  hard  drive  are 
accessible . 

Along  with  an  interoperable  enterprise  network,  NMCI 
is  working  with  the  Marine  Corps  to  standardize  software. 
When  the  NMCI  conversion  began,  the  Marine  Corps  had  close 
to  one  thousand  legacy  applications  running.  From  the 
stand  point  of  interoperability,  the  use  of  so  many 
software  applications  is  unsupportable .  By  eliminating 
useless  software  and  allowing  only  approved  software  on  the 
network,  NMCI  has  continued  the  surge  toward  software 
standardization  and  interoperability.  EDS  has  been  working 
with  the  Marine  Corps  to  manage  these  programs  while 
gradually  increasing  requirements  to  weed  out  the  old 
legacy  applications  and  move  toward  a  more  standardized 
software  package.  In  the  meantime,  applications  that  do 
not  meet  standards  and  requirements  are  placed  in 
quarantine  until  they  are  phased  out  or  converted  to  an 
approved  application. 

Since  NMCI  owns  all  of  the  hardware  and  software 
licenses  used  on  the  network,  they  are  also  responsible  to 
keep  this  equipment  current  with  industry  standards.  To 
stay  current,  NMCI  is  responsible  for  conducting  a  hardware 


This  not  only  not  only  ensures 


refresh  every  three  years.5 
that  changes  within  the  DOD  and  DON  are  supported,  but  it 
also  ensures  that  hardware  will  continue  to  support  the 
latest  applications  and  continues  to  support  the  intent  of 
interoperability . 

Lessons  Learned 

The  Marine  Corps  thinks  so  highly  of  lesson  learned 
that  they  have  established  a  center  to  gather,  disseminate, 
and  archive  all  lesson  learned  developed.  With  over 
500,000  users,  NMCI  is  the  biggest  outsourced  network  in 
the  military,  and  as  a  result,  its  integration  has  provided 
for  many  valuable  lessons  learned  that  should  be  garnered 
by  the  Marine  Corps  and  other  external  agencies.6 

One  of  the  biggest  lessons  learned  was  that  of  Due 
Diligence.  The  web  page  "www.answers.com",  describes  Due 
Diligence  as  confirming  material  and  facts  before  a  sale.7 
This  applies  to  EDS  and  the  Marine  Corps  in  the  context  of 
legacy  applications.  When  EDS  was  awarded  the  NMCI 
contract,  they  conducted  surveys  inquiring  about  the  legacy 

5  Joseph  Ciprano,  "What  NMCI  Means  to  Us,"  CHIPS  magazine, 
<http://www.chips.navy.mil/archives/01  nmci/cipriano . htm>  (18  November 
2005)  . 

6Tiboni,  "Navy  Marine  Corps  Intranet  75  percent  done," 
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7 "Due  Dilligence"  answers.com,  <http://www.answers.com/topic/due- 
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applications  running  on  the  legacy  network.  EDS  failed  to 
capture  the  entire  scope  of  legacy  applications  impart  due 
to  the  lack  of  support  that  was  received  from  the  Marine 
Corps.  In  many  cases  applications  were  running  on  the 
legacy  network  with  almost  total  autonomy  or  with  only  one 
or  two  individuals  managing  the  applications.  This 
situation  only  became  prevalent  when  the  conversions  began 
and  the  discrepancies  were  noticed.  The  result  is 
quarantined  software  that  requires  a  separate  network  to  be 
maintained.  This  means  that  many  DON  employees  who  have 
been  converted  to  NMCI  must  have  two  computers  to 
effectively  do  their  jobs.  One  computer  runs  NMCI  approved 
applications  and  software  the  other  computer  runs 
unsupported  legacy  applications.  If  more  attention  to 
detail  had  been  given  to  what  programs  were  running  and 
what  support  would  be  required,  the  problem  with  legacy 
applications  could  have  been  better  prepared  for  and 
mitigated . 

The  procurement  process  for  acquiring  outsourced 
services  and  products  need  to  be  closely  considered  as  a 
lesson  learned  as  well  as  another  example  of  Due  Diligence. 
Once  it  has  been  determined  that  a  service  or  product  will 
be  purchased,  a  lengthy  process  of  advertising  and  bidding 
is  done  before  a  contract  is  awarded.  EDS  was  not  the  only 


bidder  for  the  contract,  but  they  were  the  lowest  bidder. 

A  fact  that  was  sure  to  have  played  a  role  in  them  being 
awarded  the  contract.  EDS  actually  underbid  the  true  value 
of  the  contract  though  and  operated  with  negative  cash 
flows  for  the  first  three  years  of  service.  They  were 
basically  unprepared  for  what  they  were  hired  to  do,  and  as 
a  result,  the  transition  has  taken  longer  than  expected  and 
met  with  more  difficulties  along  they  way.8 

Finally,  it  is  important  to  understand  that  major 
cultural  changes  such  as  the  outsourcing  of  NMCI  will  have 
on  military  members.  Because  outsourcing  involves  "taking 
away"  tasks  that  were  previously  performed  by  government 
employees  and  military  members,  it  is  usually  greeted  with 
resistance  that  can  slow  the  process  down.  However, 
implementing  a  performance-based  alternative  where  both  the 
contractor  and  military  organization  mutually  benefit  and 
appreciate  the  value  of  achieving  common  goals,  will  help 
alleviate  potential  tension. 

The  lessons  learned  from  outsourcing  the  entire  DON  IT 
infrastructure  has  had  a  significant  affect  on  the  way 
business  is  conducted  within  the  DON  and  especially  the 


Dawn  Onley,  "Hanlon  on  NMCI  'EDS  was  not  prepared' , "  Government 
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Marine  Corps.  This  bears  noting  for  the  benefit  of  future 
outsourced  projects. 

Conclusion 

NMCI  began  as  an  idea  by  the  Secretary  of  the  Navy  as 
a  way  of  improving  the  IT  infrastructure  within  the  DON. 
Since  then,  NMCI  has  been  a  sore  spot  across  the  Marine 
Corps.  There  have  been,  however,  some  improvements.  The 
DON'’  s  networks  are  now  more  secure  as  a  result  of 
consolidating  entry  points  and  the  timeliness  and 
efficiency  of  employing  security.  Under  NMCI,  the  Marine 
Corps  is  standardizing  hardware  and  software  to  facilitate 
interoperability  within  the  DON  and  with  the  other 
services.  Finally,  there  have  been  valuable  lessons 
learned  from  outsourcing  NMCI,  such  as,  the  application  of 
due  diligence  and  the  importance  of  knowing  what  is 
reguired  and  expected  from  both  parties.  NMCI  certainly 
was  not  welcome  by  the  Marine  Corps,  but  Marines  always 
make  the  best  of  what  they  have  available. 
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